ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d

Sharing

Copy URL Twitter E-mail

General

Target

ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d
Size

209KB
MD5

614b2e4fbe3537cf7393d40c84e3ce59
SHA1

630fe1d549bcac69ab1f7033d65c4f06c97ed13f
SHA256

ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d
SHA512

5a10c027fddf1031edd45e4f66a70ae28f8afa04fd3ebd61ac668d7c52dea790373974b2cae6ff128bd716c69b40114793393ea96159ede14b0db6b37f971f5c
SSDEEP

6144:fqmfmqqDLe0jlYhejQO92RAxemxRsbdvGzIZ/o7BE76K5cct1kWk:fqmfDqne0jlYUwW/s5Gzc/gYxc41kWk

Score

N/A

Malware Config

Signatures

Files

ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d
.exe windows x86

4669ea28d46f3db21d252b5a332073b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
CreateMutexW
FindFirstFileW
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
GetCurrentProcess
SetFilePointerEx
GetLogicalDriveStringsW
HeapFree
GetProcessHeap
SetFileTime
VirtualQueryEx
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
lstrcpynW
Thread32Next
GetTimeZoneInformation
DuplicateHandle
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
LoadLibraryA
VirtualAllocEx
FindClose
Process32FirstW
RemoveDirectoryW
QueryDosDeviceW
Process32NextW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
CreateRemoteThread
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TerminateProcess
OpenEventW
GetFileAttributesExW
WaitForMultipleObjects
CreateEventW
GetVersionExW
VirtualFreeEx
VirtualFree
GetComputerNameW
SetErrorMode
GetCommandLineW
IsBadReadPtr
SetThreadPriority
GetCurrentThread
ResetEvent
CreateThread
GetLocalTime
GetLastError
GetSystemTime
GetNativeSystemInfo
GetProcessId
VirtualAlloc
SetThreadContext
GetThreadContext
WriteProcessMemory
VirtualProtectEx
GetCurrentProcessId
GlobalUnlock
GlobalLock
ExpandEnvironmentStringsW
LocalFree
CreatePipe
ExitThread
ReadFile
SetHandleInformation
CreateProcessW
GetUserDefaultUILanguage
GetModuleFileNameW
MoveFileExW
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
SetFileAttributesW
lstrcmpiW
GetModuleHandleW
WTSGetActiveConsoleSessionId
lstrcmpiA
Sleep
LoadLibraryW
SetEvent
WaitForSingleObject
CreateDirectoryW
FreeLibrary
ExitProcess
CloseHandle
EnterCriticalSection
GetProcAddress
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
MultiByteToWideChar

user32

CallWindowProcA
CallWindowProcW
DefWindowProcW
DefFrameProcW
RegisterClassA
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
ReleaseDC
CharUpperW
SetWindowLongW
GetWindow
RegisterClassW
GetDC
CharLowerW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
DefDlgProcW
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
ExitWindowsEx
MessageBoxA
GetKeyboardLayoutList
DefMDIChildProcA
DefDlgProcA
SwitchDesktop
GetSystemMetrics
MapVirtualKeyW
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
DrawIcon
GetIconInfo
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
PostThreadMessageW
HiliteMenuItem
EndMenu
EndPaint
GetShellWindow
GetUpdateRgn
RegisterClassExA
DispatchMessageW
GetWindowDC
TranslateMessage
GetKeyboardState
GetClipboardData
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
RegisterClassExW
GetDCEx
ToUnicode
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
GetCursorPos
SendMessageTimeoutW
DefWindowProcA
CloseDesktop
DefMDIChildProcW
IsWindow
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
CharToOemW
CharLowerBuffA

advapi32

EqualSid
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
IsWellKnownSid
GetLengthSid
CreateProcessAsUserA
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
InitiateSystemShutdownExW
RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW

shlwapi

SHDeleteKeyW
PathQuoteSpacesW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
PathRemoveFileSpecW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
StrStrIW
StrStrIA
PathRenameExtensionW
StrCmpNIW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

GetDeviceCaps
CreateCompatibleBitmap
DeleteObject
GetDIBits
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
RestoreDC
SaveDC
SetRectRgn
GdiFlush
SetViewportOrgEx

ws2_32

listen
send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
inet_addr
getpeername
recvfrom
WSASend
gethostbyname
WSAIoctl
connect
WSAEventSelect
getsockname
accept
sendto
setsockopt
shutdown
WSAGetLastError
select
getaddrinfo
WSAStartup
WSAAddressToStringW

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetCrackUrlA
HttpOpenRequestA
HttpAddRequestHeadersA
InternetOpenA
InternetQueryDataAvailable
InternetSetOptionA
InternetQueryOptionW
InternetQueryOptionA
HttpEndRequestW
HttpSendRequestA
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetSetStatusCallbackA
HttpSendRequestExW
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
HttpSendRequestExA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4669ea28d46f3db21d252b5a332073b7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 196KB - Virtual size: 196KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 196KB - Virtual size: 196KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 8KB